Critical Authentication Bypass in SAP NetWeaver (CVE‑2020‑6287) Enables Unauthorized Admin Creation
What It Is – SAP NetWeaver Application Server Java contains a missing authentication check on a critical configuration function. An unauthenticated actor can invoke the function to execute configuration tasks and create privileged administrative users.
Exploitability – The flaw is publicly disclosed (CVE‑2020‑6287) and has a CVSS 3.1 base score of 9.8 (Critical). No public exploit code has been released, but the vulnerability is trivially exploitable by sending crafted HTTP requests to the affected endpoint.
Affected Products – SAP NetWeaver Application Server Java (all supported versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Access Control – The vulnerability bypasses authentication, directly violating the control objective of “enforcing proper authentication and authorization for privileged functions.”
- Configuration Management – Unauthorized configuration changes undermine the integrity of system settings, a key evidence point in audit trails.
- Continuous Assurance – Enterprises must demonstrate that privileged account creation is logged, monitored, and approved; this flaw shows a gap that can be exposed during third‑party risk assessments.
Recommended Actions
- Apply SAP’s security patch for CVE‑2020‑6287 immediately.
- Conduct a post‑patch validation to confirm the authentication check is enforced.
- Review all existing administrative accounts for unauthorized creations and enforce MFA where possible.
- Enable comprehensive logging of privileged actions and integrate with a SIEM for real‑time alerting.
- Update your access‑control policies to require dual‑approval for any configuration changes.
Source: CISA KEV – CVE‑2020‑6287